Attackers impersonate ChatGPT, Claude and Perplexity bots to hunt for exposed credentials
THREAT ACTORChatGPTredteam/daily · 2 sources
- Severity
- Medium
- Sources
- 2
What happened
A single actor reportedly rotated through about 32 bot identities, including ChatGPT, Claude and Perplexity, to scan enterprise websites for exposed passwords, API keys and cloud credentials. Cequence tracked the campaign across multiple industries, and on one October day it reached 48% of the organisations it protects that received any such traffic. Teams should review bot management rules and check public-facing sites for leaked secrets.
For IT people · Written by AI from 2 sources · Wrong?
What to do
- Do not trust user-agent strings alone; verify AI crawler traffic against published IP ranges or signatures.
- Scan public-facing websites and their source code for exposed passwords, API keys and cloud credentials.
- Rotate any credentials found to be exposed and restrict access to sensitive endpoints.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
GBHackersCyber Security News